Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Using Windows Server 2003 active directory with multiple domains in separate forests (using two-way trusts) is there any way I can create a group on one domain that includes users from another domain?

For example:

CENTRAL domain users:
CENTRAL\Alice
CENTRAL\Bob

BRANCH Domain Users:
BRANCH\Carol
BRANCH\Dave

There is a two-way trust between BRANCH and CENTRAL, but they are not in the same forest.

Is there any way to make a group in the CENTRAL domain that includes all four users? When I tried this I found that the membership properties of the group only let me search for users in the CENTRAL domain.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

If you use a DOMAIN LOCAL group, you'll be able to add the users from both domains to the one group.

Better still, add a Global/Universal group from the BRANCH domain (and the same from the CENTRAL domain) to the Domain Local group:

CENTRAL DOMAIN
SPECIAL GROUP
CENTRAL\Alice
CENTRAL\Bob

BRANCH DOMAIN
SPECIAL GROUP
BRANCH\Carol
BRANCH\dave

CENTRAL DOMAIN
JOINT DOMAIN LOCAL GROUP
CENTRAL\Special Group
BRANCH\Special Group

That way, adding new members to the JOINT group just means adding them to the global group within their domain.

share|improve this answer
    
Perfect. Somewhat counter-intuitive to use the group type named "local" to be able to include remote onjects, but exactly what I needed. –  DrStalker Jul 6 '09 at 6:56
    
That was very clearly put, could you go to work at Microsoft writing documentation, please? –  Kara Marfia Jul 6 '09 at 13:07
add comment

Yes the "global" and "local" naming of groups refers to where they can be used, not what they can contain.

Also insert usual replication disclaimer about universal groups here.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.